CVE-2026-72089

In the Linux kernel, the following vulnerability has been resolved:

accel/ivpu: Reject firmware log with size smaller than header

fw_log_from_bo() validates the tracing buffer header_size and that the

log fits within the BO, but never checks that log->size is at least

log->header_size. fw_log_print_buffer() then computes:

u32 data_size = log->size - log->header_size;

which underflows to a near-U32_MAX value when firmware reports a log whose

size is smaller than its header. That huge data_size defeats the

log_start/log_end bounds clamps added by commit dd1311bcf0e6 ("accel/ivpu:

Add bounds checks for firmware log indices"), so fw_log_print_lines() reads

far past the small real data region of the BO. A size of 0 also makes

fw_log_from_bo() advance the offset by 0, causing the callers to loop

forever on the same header.

Reject logs whose size is smaller than the header (which also rejects

size == 0).